Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,831 detections
Filters
Last updated
All Time
Detection languages
1,374
495
363
281
175
Contributors
848
453
393
252
188
Categories
20,440
11,814
5,871
5,145
4,864
2,831
Platforms
1,448
916
693
670
264
Products / Services
994
700
613
469
216
MITRE Techniques
1,239
911
484
481
388
CVEs
6
5
2
1
1
IDS Classtypes
15
10
6
5
3
IDS Protocols
39
Detects when a user authorizes the 'ToogleBox Recall' Google Workspace add-on. This tool has been observed being used by threat actors like UNC6661 (associated with ShinyHunters) to automate the deletion of MFA enrollment notifications, hiding unauthorized device registrations.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
`This rule looks for API calls that stops logging for CloudTrail Lake channels and a trail configuration.
These actions would prevent logging of CloudTrail logs from the time of API call.
These actions would prevent logging of CloudTrail logs from the time of API call.
Detects modification of an AWS IAM role's trust policy to include a principal from an unknown or untrusted AWS account. This is a common persistence technique used by attackers to maintain access to a compromised environment by allowing their external account to assume the role.
Looking for changes of remiving the delivery channel or configuration recorder for AWS Config.
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
Indicative of defense evasion or someone covering their tracks.
This would stop all data such as configuration snapshots and rule compliance notifications from getting to the S3 bucket/SNS topic.
Note: Before you can delete a delivery channel, you must first stop the customer-managed configuration recorder
This rule detects a multi-stage attack chain starting with a high-confidence phishing email, followed by a risky sign-in from the recipient, and culminating in sensitive actions within Azure, specifically targeting IAM role assignments, storage account key access, or AKS cluster modifications. The detection correlates these events within a defined time window to identify potential compromise of cloud resources originating from a successful phishing attack.
Detects when a user flagged as 'high risk' by Azure AD Identity Protection lists storage account keys. This could indicate a compromised account is being used to access sensitive data or escalate privileges.
This rule detects successful 'GetObject' operations on AWS S3 buckets originating from external IP addresses (not within common private IP ranges). This could indicate an attempt to exfiltrate data from S3 buckets by an unauthorized entity or compromised credential.
This rule detects attempts to delete S3 bucket logging configurations originating from IP addresses not associated with AWS infrastructure. This could indicate an attacker attempting to cover their tracks by disabling logging for an S3 bucket after gaining unauthorized access.
Detects a sequence of events where an AWS IAM Role Trust Policy or a Role's managed policy is modified (UpdateAssumeRolePolicy, PutRolePolicy) and is immediately followed by a successful assumption of that role (AssumeRole, AssumeRoleWithSAML, etc.) within a 10-minute window. This behavior is characteristic of an attacker setting up a backdoor or escalating privileges by granting a new, unauthorized principal (user, service, or account) permission to assume a critical role.
This rule detects Amazon S3 PutObject events where server-side encryption is performed using SSE-C (Server-Side Encryption with Customer-Provided Keys) or where the request uses Signature Version 2 (SigV2). SSE-C relies on the customer to manage encryption keys, which can introduce risks if not handled securely. SigV2 is an older, less secure authentication protocol for AWS requests and its use is generally discouraged in favor of SigV4.
Detects attempts to tamper with AWS CloudTrail or GuardDuty logging configurations by monitoring specific API calls that can disable, modify, or delete logging mechanisms. This includes actions like stopping logging, deleting trails, updating trails, disassociating from master accounts, archiving findings, stopping member monitoring, and deleting or updating detectors. Successful execution of these actions without an error indicates potential malicious activity aimed at evading detection.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects anomalous increases in AWS API calls resulting in "AccessDenied" errors for a single identity and source IP address, relative to that identity's historical baseline over the past 30 days. Sudden increases in denied requests or the variety of APIs being denied may indicate reconnaissance, permission probing, or misconfigured automation attempts by an adversary.
Detects when an AWS IAM role is assumed by an identity that has not used that specific role within a historical 7-day window. This behavior can indicate lateral movement, privilege escalation, compromised credentials, or a deviation from normal workload patterns. The rule excludes AWS internal service identities to focus on human and workload actors.
Detects the creation or modification of an IAM Role trust policy that grants assume-role permissions to an AWS account that is not part of the organization. This action creates a backdoor for an external entity to gain persistent access to your environment, often used by attackers to maintain unauthorized access. This rule relies on an `aws_org_accounts.csv` lookup table to identify accounts belonging to the organization. If this lookup is not established, manual filtering of AWS accounts will be required.
Service Accounts may need to be filtered.
Service Accounts may need to be filtered.
This search detects the creation of a public GitHub repository with the description "Sha1-Hulud: The Second Coming". This is a specific indicator of compromise (IOC) associated with the Shai-Hulud 2.0 worm, which uses these repositories to exfiltrate stolen credentials.
Detect when System Manager successfully executes commands against an instance.
Detects S3 object encryption using either customer-provided keys (SSE-C) or externally managed KMS keys (BYOK/XKS). These methods are leveraged by S3 ransomware variants to encrypt data with keys that are not controlled by the victim or AWS, making recovery difficult or impossible without paying a ransom.
Detects various sensitive configuration modifications in AWS that could indicate malicious activity, such as privilege escalation, defense evasion, or data exposure. This rule looks for a curated list of API calls related to changes in IAM, EC2 security groups, S3 bucket policies, and logging configurations.
Detects when a user creates a new secret within GitHub for an organization, environment, codespace, or repository. This activity is critical to monitor as secrets often contain sensitive credentials (e.g., API keys, tokens) that, if compromised or misused, can lead to unauthorized access, privilege escalation, or persistence within the GitHub environment. The rule specifically looks for audit log actions indicating the creation of these secrets.
Page 107 of 135